I am trying to correctly configure a shared folder on server 2012 and have read a few articles - such as this one) - that state that the NTFS & Share permissions are combined and evaluated to provide the Effective Permissions using the Most Restrictive rule.

I have configured the folder share such that the share permissions are Everyone/Full control and the NTFS permissions are Everyone/Read.

I would have thought that this would result in an effective permission of Everyone/Read. However, everyone can still write to the folder.

Any idea what I have misconfigured? Or is this configuration not possible?

  • What other NTFS permissions, if any, are on the folder? – Todd Wilcox Mar 3 '16 at 12:04
  • What you may be missing is the fact that NTFS permissions are combined to provide an effective permission using the Least Restrictive rule. My guess is that the Users group (or another group of which your user accounts are members) are on the ACL of the folder(s) and have less restrictive NTFS permissions on the folder(s). – joeqwerty Mar 3 '16 at 15:42
  • as I noted in the question, I understand the Most Restrictive Rule/Least Restrictive Permission concept. The moment I disabled permission inheritance on the folder everything started working as I expected. So clearly there was rule in play that was not clear from the folder security UI. – user783836 Mar 4 '16 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.